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ABSTRACT 

This paper describes the results of an independent 
analysis of the primary and contributory causes of 
aviation accidents in Canada between 1996 and 2003. 
The purpose of the study was to assess the comparative 
frequency of a range of causal factors in the reporting of 
these adverse events. Our results suggest that the 
majority of these high consequence accidents were 
attributed to human error. A large number of reports 
also mentioned wider systemic issues, including the 
managerial and regulatory context of aviation 
operations. These issues are more likely to appear as 
contributory rather than primary causes in this set of 
accident reports. 
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INTRODUCTION 

Reason [1] has recently distinguished the ‘person’ from 
the ‘system’ approach to accident analysis. Each of 
these perspectives implies a radically different view of 
causation. The ‘person approach focuses on the errors 
of individuals, blaming them for forgetfulness, 
inattention, or moral weakness’. In contrast, the system 
approach ‘concentrates on the conditions under which 
individuals work and tries to build defenses to avert 
errors or mitigate their effects’. Similarly, Cook and 
Woods [2] argue that accidents occur through the 
concatenation of multiple small failures. Each of these 
causes is necessary. However, they are each 
insufficient to cause the failure unless they occur in 
combination with other potential causes. Often these 
small failures have roots that extend well back from the 
moment when the accident is triggered. This analysis is 
careful to distinguish between the operators who often 
trigger an incident ‘at the sharp end’ and the managers 
and regulators who often create the latent conditions for 
a failure ‘at the blunt end’. In particular, managerial 
and regulatory problems often make it possible for 
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combinations of these minor failures to build up over 
time and hence create the preconditions for failure. 

There is considerable controversy over this systemic 
view of failure [3], It can be difficult to identify 
precisely which factors play a significant role in the 
latent causes of an accident or incident. For example, 
the operational pressures of their everyday tasks may 
influence operator behaviour. The causes of these 
pressures can be traced back to particular management 
decisions distributed throughout the tiers of 
responsibility within a company. Often the systemic 
causes of adverse event will ultimately lead to the 
regulatory authorities and certification bodies that help 
to create the environment in which a management board 
will operate. The proponents of the ‘systemic’ view 
can reasonably argue that regulators must ultimately 
bare responsibility for accidents in the industries that 
they regulate. However, this ignores the legislative and 
political constraints that limit the regulators’ scope for 
intervention. Similarly, it is important to question 
whether or not upper-levels of management can 
reasonably be expected to understand the detailed 
working practices that characterise the everyday 
operation of complex technology. In particular, 
previous studies of adverse events such as the Bristol 
Infirmary failures have shown that middle and junior 
levels of management often find it difficult to pass bad 
news to their more senior colleagues [3]. 

The regulations that govern the work of most accident 
investigation agencies seldom emphasize the importance 
of ‘systemic factors’. For example, the Canadian 
Transportation Accident Investigation and Safety Board 
Act, 1989, c. 3, the Transport Safety Board (TSB) must 
identify “causes and contributing factors” to identify 
“safety deficiencies as evidenced by transportation 
occurrences”. It is not the function of the Board “to 
assign fault or determine civil or criminal liability, but 
the Board shall not refrain from fully reporting on the 
causes and contributing factors merely because fault or 
liability might be inferred from the Board's findings. A 


number of further factors can prevent investigators from 
exploring the range of minor failures that together 
combine to create the preconditions for adverse events. 
In particular, resource constraints limit the scope of 
many investigations. Most investigation agencies 
operate with a relatively small core staff. They rely on 
external support to provide additional expertise. 
However, there are inevitable shortages of skilled 
personnel in several key areas, including software 
forensics. Further problems are created by the lack of 
recognized analytical techniques that might be used to 
guide and validate the ‘systemic’ analysis of adverse 
events. From this it follows that it can be difficult to 
determine whether or not investigators have considered 
an adequate range of causal factors during any particular 
investigation. 

A number of leading accident investigators have written 
on the importance of ‘systemic’ factors in the causes of 
adverse events. For example, Strauch [4] argues that 
the ‘transformation of error perspective’ from blaming 
the operator to identifying the contribution of system 
elements ‘has, I believe, led to profound changes in the 
way we investigate, consider, and respond to accidents’. 
Similarly, Ayeko [5] has argued that ‘to learn a lesson 
from an accident one must understand not only the 
immediate cause but also contributing factors and 
underlying conditions of the accident’. He goes on to 
state ‘it is my belief that, when we seek “cause” rather 
than “information about cause” in an investigation of an 
accident, the direction of the investigation often veers 
towards elements that are more likely to be linked to 
blame rather than the mitigation of risks’. We were 
concerned to determine whether these ‘systemic’ views 
of complex, technological failure have had a discemable 
impact on the work of accident investigation agencies. 

It can be difficult to measure the impact that a particular 
view of accident causation has upon the working 
practices of an investigatory organization. For example, 
most investigatory organizations analyzed a range of 
causal factors well before authors such as Perrow [6] 
and Reason [1] articulated the ‘systems view’. It is 
likely, therefore, that the impact of ‘systemic’ ideas can 
only be measured in terms of a relative change in the 
scope of any analysis rather than a dramatic or sudden 
change in investigatory practices. It is also difficult to 
know what to measure in order to determine whether 
there has been any movement from the ‘person’ view to 
the ‘systems’ view of adverse events. 


Method 

The method adopted in this study involved the two co- 
authors performing an independent analysis of all of the 
major aviation accident reports published between 1996 
and 2002 by the Canadian TSB. The investigators each 
had more than a decade’s experience in the development 
of safety-critical systems. Each has been active in the 
analysis of system failures for more than five years. The 
decision to focus on Canadian accident reports was 
justified because this forms one part of a larger 
international study, a companion paper described the 
results of applying this technique to US NTSB 
investigations. The start date was determined by 
pragmatism. It was felt that this provided a sufficiently 
large sample to support our analysis within the time 
available to our study. This sample yielded a total of 
27 accident reports. The most recent report available at 
the time of writing, February 2004, was published in 
2002. The reports ranged from high profile, multiple 
fatality accidents such as the loss of Swiss Air Flight 
111 through to less severe loss-of-separation incidents. 
The heuristic that we adopted was to investigate every 
aviation incident report that was composed of distinct 
numbered sections between 1996 and 2002. We also 
substituted a number of the less structured, reports for 
2002. These were reports A02C0124, A02F0069, 
A02P0109, A02Q0130. This decision was justified by 
the need to avoid a gap in our sample for the last two 
years. We were also unable to determine whether this 
less structured format will provide a standard for future 
TSB reports. Even with these additions, our sample is 
relatively small compared to the 1,812 accidents and 
1,374 incidents that were reported to the Candian TSB 
in 2002. A considerable process of filtering was used by 
the investigatory agencies to select the most serious of 
these incidents for investigation. In consequence, our 
sample focuses on those higher risk mishaps, including 
near misses, which were deemed serious enough to 
warrant a subsequent investigation and report. 

The analysis progressed by extracting the causal and 
contributory factors that were identified in the aftermath 
of each investigation. Canadian TSB reports contain a 
section in their abstract that lists ‘Findings As To 
Causes and Contributing Factors’. Once these sections 
had been extracted, the two investigators performed 
their analysis independently. All subsequent stages 
were also performed in isolation from each other until 
the results were available for comparison. The second 
stage of the analysis was to assign each of the probable 
causes and contributory factors to a number of common 
categories. We decided not to use any pre-defmed 
taxonomy but to allow each of the investigators to 



independently assign their own terms to each of the 
‘causes’. 

The results of this process were then collated. There 
were some obvious differences in the terms used but 
there were also some strong similarities. For instance, 
one analyst identified ‘human error’ while another 
distinguished between ‘aircrew error’, ‘ATM error’ and 
so on. Where such disagreements occurred we used a 
process of discussion to agree on a common term to 
support comparisons between the classifications. For 
example, we agreed to use the more general term 
‘human error’. The term ‘ATM failure’ was used 
instead of ‘ATM error’ because it was often unclear 
whether a particular cause or contributory factor could 
be associated with the manager’s actions or with design 
problems in their information systems. Distinctions 
were preserved between different terms where no 
agreement could be reached between the two analysts. 

Results 

As mentioned, our sample reports included separate 
sections on "Findings As to Causes and Contributing 
Factors”. Our analysis was complicated, however, 
because the TSB does not distinguish probable causes 
from contributory factors in these sections. For 
instance, report A02F0069 contained the following list: 

1 . The pilot not flying (PNF) inadvertently entered 
an erroneous Vi speed into the MCDU. The 
error was not detected by either flight crew, 
despite numerous opportunities. 

2. The PNF called "rotate" about 25 knots below 
the calculated and posted rotation speed. 

3. The pilot flying (PF) initiated rotation 24 knots 
below the calculated and posted rotation speed 
and the tail of the aircraft struck the runway 
surface. 

4. A glide path signal was most probably distorted 

by a taxiing aircraft and provided erroneous 
information to the autopilot, resulting in a pitch- 
up event. The pitch-up could have been 
minimized if the autopilot had been 

disconnected earlier by the PF. 

As can be seen, there is no indication as to which of 
these items is a cause and which is a contributory factor. 
Each analyst, therefore, had to use his own judgment. 
Both analysts independently identified three causes 
relating to human error and one contributing factor 


relating to equipment failure. Analyst M also identified 
three causes involving human error. However, they 
argued that the sole contributory factor should be 
classified as a problem with equipment design. 

This reliance on individual judgment created 
disagreement over causes and contributory factors. 
Analyst J found 53 causes and only 35 contributory 
factors. Analyst M found correspondingly fewer 
causes, 44, and more contributory factors, 71. A more 
formal method for distinguishing causes from 
contributory factors could have reduced this variance 
(Johnson, 2003). At the start of the study, we decided 
not to use a more formal approach because the 
development of appropriate root cause analysis 
techniques remains an active area for research. We 
were also keen to employ the subjective criteria that 
might be employed by the readers of these documents. 

As mentioned, the 27 incidents yielded a total of 53 
probable causes for the first analyst. The mean number 
of probable causes was 1 .9 with a standard deviation of 
1.2. The second analyst identified 44 probable causes 
with a mean of 1.6 and a standard deviation of 1. There 
were 35 contributory causes identified by the first 
analyst with a mean of 1.3 and a standard deviation of 
2.5. The second analyst identified 71 contributory 
causes with a mean of 2.5 and a standard deviation of 
3.9. The mode over all probable causes was 1 while the 
mode for all contributory causes was 0. 

The standard deviation associated with the mean results 
for both causes and contributory factors is relatively 
high. This can be explained in terms of a small number 
of reports, which were very different from the mode of 
one cause and zero contributory factors. In particular, 
both analysts identified two causes in report A97H0011. 
However, analyst J identified 13 contributory factors 
while M found 20 in this single incident. This report 
describes a loss of control on go-around under adverse 
weather conditions. Analyst J identified human error 
and problems in air traffic management as the main 
causes. Analyst M identified two instances of ‘human 
error’. The thirteen contributory factors identified by 
Analyst J included five instances of managerial failure, 
two human errors, two regulatory problems, two aircraft 
design issues, a maintenance failure and a problem 
relating to the operational environment in which the 
accident occurred. In contrast, analyst M identified 
three human errors, seven management issues, six 
regulatory failures, three environmental factors and one 
instance of equipment failure. A number of other 
atypical reports also helped to pull the standard 
deviation away from the mode. For example, both 



analysts identified five instances of human error causing 
the incident described in TSB report A99Q0151 : 

“The pilot flying did not establish a maximum 
performance climb profile, although required by the 
company's standard operating procedures (SOPs), 
when the ground proximity warning system (GPWS) 
"Terrain, Terrain" warning sounded during the 
descent, in cloud, to the non-directional beacon 
(NDB). The pilot flying did not fly a stabilized 
approach, although required by the company's SOPs. 
The crew did not carry out a go-around when it was 
clear that the approach was not stabilized. The 
crew descended the aircraft well below safe 
minimum altitude while in instrument 
meteorological conditions. Throughout the 
approach, even at 1 00 feet above ground level (agl), 
the captain asked the pilot flying to continue the 
descent without having established any visual 
contact with the runway environment. After the 
GPWS "Minimums, Minimums" voice activation at 
1 00 feet agl, the aircraft's rate of descent continued 
at 850 feet per minute until impact. The crew 
planned and conducted, in cloud and low visibility, 
a user-defined global positioning system approach 
to Runway 31, contrary to regulations and safe 
practices.” 

Tables 1 and 2 summarise the data from our study. 
Although there is some disagreement over individual 
incidents, there is considerable consensus across the 
sample. Both investigators identified human error as 
the most common causal factor across the TSB sample 
at 56% for analyst J and 75% for analyst M. The 
relative difference between the proportions of incidents 
identified by the two analysts can be partly explained in 
terms of the broader range of categories that were 
considered by analyst J compared to analyst M. For 
example, analyst J also included Toadmaster error’ (2%) 
and ‘ATM error’ (6%) that were not included within the 
classification used by analyst M. With this caveat, the 
remaining results show considerable agreement; both 
analysts fall within one or two percent of their 
colleagues classification for environmental causes with 
9%(J) and 7% (M), aircraft design 4% (J) and 5% (M), 
equipment failure 9% (J) and 9% (M), regulation 4% (J) 
and 2%(M), maintenance 2% (J) and 2% (M). 

Table 2 shows that human error plays a lesser role in the 
contributory factors that were identified by both analysts 
in the TSB sample; 22% by analyst J and 28% by 
analyst M. Again, there is considerable agreement in 
terms of the overall percentages for each category of 
contributory factor. Analyst J identified 28% of all 


contributory factors as being related to company 
management. Analyst M found this in 27% of the 
factors in the accident reports. The agreement 
continued in regulation with 9%(J) and 11%(M), 
equipment failure 9%(J) and 7% (M), environmental 
factors 9% (J) and 8% (M). There is a more noticeable 
disagreement over the role of aircraft design. Analyst J 
identified it in only 9% of these contributory factors. 
Analyst M identified design flaws in 15% of the factors 
in the TSB sample. This can be explained in terms of a 
cluster of incidents in 1998. Analyst M identified three 
aircraft design flaws in the contributory factors for 
A98H0003, two in A98H0002 and A98H0011 and one 
in A98C0173. In contrast, Analyst J identified 
management failure as a contributory factor behind 
these design flaws. 

These statistics reemphasize the importance of human 
error as a causal factor. We did not, however, identify 
any trend away from blaming the operator as might be 
predicted given the popularity of ‘systemic theories’ of 
failure in recent years. The frequency of human error 
identified by analyst J is: 3 probable and 1 contributory 
(1996), 2 probable and 3 contributory (1997), 6 probable 
and 1 contributory (1998), 9 probable and 0 contributory 
(1999), 4 probable and 1 contributory (2000), 1 probable 
and 1 contributory (2001), 6 probable and 1 contributory 
(2002). The frequency of distribution for analyst M is: 
3 probable and 2 contributory (1996), 4 probable and 5 
contributory (1997), 6 probable and 6 contributory 
(1998), 10 probable and 0 contributory (1999), 4 
probable and 3 contributory (2000), 1 probable and 1 
contributory (2001), 5 probable and 2 contributory 
(2002). The peak in 1999 is due largely to A99Q0151, 
mentioned earlier. There are also relatively high levels 
of human error identified during 1998 and 2002. 2002 
was similar to 1999, with a single incident documented 
as A02F0069 producing several different forms of 
human error. In contrast, several different explain the 
rise in 1998 reports each with a small number of 
operator ‘errors’: A98Q0192, A98P0303, A98H0011, 
A98H0003, A98H0002, A98C0173, A98A0191, 

A98A0067. It is difficult to identify any trends that 
might characterize any change in the ‘systemic view’ 
over the ‘person’ approach to causal analysis, at least in 
terms of the distribution of human error between 1996 
and 2002. 
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Table 2: Frequency of Contributory Causes over Time. Analysts J & M. Parentheses represent number of different incidents, Canadian TSB. 





Although human error is still the most prominent causal 
and contributory factor in our study, it is important not 
to underestimate the frequency of managerial and 
regulatory failures. These issues play a greater role in 
the contributory factors than they do in probable causes. 
Managerial issues account for around 1% of all causes 
and 27% of contributory factors across both analysts. 
Regulatory issues account for 3% of all causes and 10% 
of all contributory factors. This not only provides 
insights into the practices and perspective of the TSB 
but for it also casts light on the two analysts who were 
involved in this exercise. Recall that the TSB reports do 
not distinguish between contributory factors and causes. 
Hence we were making qualitative judgements about 
those failures that should be assigned to each general 
classification. This analysis suggests that we were 
predisposed to view human error as a more salient 
probable cause than either managerial factors or 
regulatory failure. 

Our results do also provide insights into the distribution 
of systemic issues within the causal and contributory 
factors between 1996 and 2002. All of the documents 
that were classified as describing these potential sources 
of failure come before 1999. From that year to 2002, 
neither analyst was able to identify any causes or 
contributory factors in managerial and regulatory 
failures. They did continue to find human causes, for 
instance analyst J found 6 instances of aircrew ‘error’ in 
2002 while their colleague found 5. To summarise, it is 
difficult to discern any pattern that might indicate a rise 
in the ‘systemic view’ of failure. In contrast, the 
decline of managerial and regulatory issues in the TSB 
reports might indicate a decline in the prominence of 
this view. 

Conclusions 

When we began this analysis, we were keen to 
determine whether or not the ‘systems’ view of failure 
was having an impact on the output of accident 
investigations. Prominent investigators in both of the 
Canadian TSB [4] and the US NTSB [5] have argued 
that these factors must be considered when identifying 
the causes of adverse events. Our results have shown 
that the TSB do consider a wide range of causal and 
contributory factors in their reports. In particular, it 
seems clear that they have a long tradition of 
considering the regulatory and managerial precursors to 
adverse events. However, they do focus on the role of 
human error as a potential cause in most of the adverse 
events that they investigate. It also seems that the role 
of managerial and regulatory issues has declined in 
prominence in recent years. We would argue that it is 


inaccurate to assert, as some have, that: (1) the operator 
is always blamed, (2) most investigations stop as soon 
as they find someone to blame, or (3) organizational 
causes are usually ignored. 

This paper has described an independent analysis of the 
primary and contributory causes of aviation accidents in 
Canada between 1996 and 2002. The purpose of the 
study was to assess the comparative frequency of a 
range of causal factors in the reporting of these adverse 
events. Our results suggest that the majority of these 
high consequence accidents were attributed to human 
error. A large number of reports also mentioned wider 
systemic issues, including the managerial and regulatory 
context of aviation operations. These issues are more 
likely to appear as contributory rather than primary 
causes in both sets of accident reports. 
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